1
2
3

Access to XMLHttpRequest at 'http://.../api/...'
from origin 'http://...' has been blocked by CORS policy:
Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response.

1
2
3

Access-Control-Allow-Credentials: true    ← 要求明确列出允许的值
Access-Control-Allow-Headers: *           ← 通配符，浏览器直接忽略并拒绝
Access-Control-Allow-Methods: *           ← 同上

1
2

add_header Access-Control-Allow-Methods "*" always;
add_header Access-Control-Allow-Headers "*" always;

1
2

add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS, PATCH, HEAD" always;
add_header Access-Control-Allow-Headers "content-type, authorization, x-requested-with, x-custom-header, accept, origin" always;